{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-25ee461c4febb44d", "name": "Stray `console.log` in TS/JS \u2014 website/plugins/file-browser/index.js:520", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 website/plugins/file-browser/index.js:520"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cfb78206a9c94e2e", "name": "Stray `console.log` in TS/JS \u2014 website/plugins/docusaurus-plugin-llms-txt/src/index.js:149", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 website/plugins/docusaurus-plugin-llms-txt/src/index.js:149"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-116d848780f3c42c", "name": "Stray `console.log` in TS/JS \u2014 website/plugins/blog-release-data/index.js:146", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 website/plugins/blog-release-data/index.js:146"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4105ad5a90a148ee", "name": "Stray `console.log` in TS/JS \u2014 website/plugins/slide-notes-extractor/index.js:13", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 website/plugins/slide-notes-extractor/index.js:13"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-56da1e5de0646d34", "name": "Stray `console.log` in TS/JS \u2014 website/plugins/doc-release-data/index.js:244", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 website/plugins/doc-release-data/index.js:244"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0673c6764aae87d6", "name": "Stray `console.log` in TS/JS \u2014 website/scripts/update-blog-releases.js:28", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 website/scripts/update-blog-releases.js:28"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b851087392c6114c", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 website/src/theme/AnnouncementBar/index.tsx:36", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 website/src/theme/AnnouncementBar/index.tsx:36"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6eb62463af760c03", "name": "TODO/FIXME marker in shipping code \u2014 website/src/theme/Navbar/Content/index.tsx:23", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 website/src/theme/Navbar/Content/index.tsx:23"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-066dd828db697aef", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 website/src/components/Screengrab/index.tsx:28", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 website/src/components/Screengrab/index.tsx:28"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-22b3eb8ffa5069d8", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 website/src/components/Glossary/Glossary.tsx:41", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 website/src/components/Glossary/Glossary.tsx:41"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7e6329c3b7b74f2f", "name": "Stray `console.log` in TS/JS \u2014 website/src/components/Definition/index.js:12", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 website/src/components/Definition/index.js:12"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-715f773c0b2dbddd", "name": "Privileged port 20 in use", "shortDescription": {"text": "Privileged port 20 in use"}, "fullDescription": {"text": "Port 20 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f772d2e522360523", "name": "Privileged port 57 in use", "shortDescription": {"text": "Privileged port 57 in use"}, "fullDescription": {"text": "Port 57 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d9a28a1c77374c88", "name": "Privileged port 15 in use", "shortDescription": {"text": "Privileged port 15 in use"}, "fullDescription": {"text": "Port 15 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bed517b6daf4be7d", "name": "Privileged port 12 in use", "shortDescription": {"text": "Privileged port 12 in use"}, "fullDescription": {"text": "Port 12 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d63da3583b14afc0", "name": "Dockerfile runs as root: Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-84019dfd8d98a34d", "name": "Docker base image is tag-pinned but not digest-pinned: debian:bookworm-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: debian:bookworm-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5072990f20615d2b", "name": "Dockerfile runs as root: demo/screenshots/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: demo/screenshots/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-eafce6eea61f96fc", "name": "Docker base image uses a mutable or implicit tag: ghcr.io/charmbracelet/vhs:latest", "shortDescription": {"text": "Docker base image uses a mutable or implicit tag: ghcr.io/charmbracelet/vhs:latest"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f92512b7ef328c83", "name": "Dockerfile ADD downloads remote content without checksum", "shortDescription": {"text": "Dockerfile ADD downloads remote content without checksum"}, "fullDescription": {"text": "Remote build inputs can change or be replaced upstream. Use Dockerfile ADD --checksum or download with an explicit digest/signature verification step."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fb597e8cf907faaf", "name": "Dockerfile runs as root: examples/devcontainer-build/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: examples/devcontainer-build/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-edb081c23d5d4d84", "name": "Docker base image is tag-pinned but not digest-pinned: cloudposse/geodesic:${GEODESIC_VERSION}", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: cloudposse/geodesic:${GEODESIC_VERSION}"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-70d998bbfb991814", "name": "Dockerfile pipes a remote installer into a shell", "shortDescription": {"text": "Dockerfile pipes a remote installer into a shell"}, "fullDescription": {"text": "Executing downloaded code during image build gives the remote endpoint build-time code execution. Prefer pinned packages or verify downloaded installers by checksum/signature."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0a5c2287e2b85e4b", "name": "Dockerfile runs as root: examples/quick-start-advanced/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: examples/quick-start-advanced/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-790c4d4441a66e2a", "name": "Docker base image is tag-pinned but not digest-pinned: cloudposse/geodesic:${GEODESIC_VERSION}-${GEODESIC_OS}", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: cloudposse/geodesic:${GEODESIC_VERSION}-${GEODESIC_OS}"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4a210ac3b4b59ff4", "name": "Dockerfile runs as root: .devcontainer/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: .devcontainer/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-369acff355c0d994", "name": "Docker base image is tag-pinned but not digest-pinned: golang:1.26.2", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: golang:1.26.2"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-214deb501ac69f4f", "name": "Docker base image is tag-pinned but not digest-pinned: mcr.microsoft.com/vscode/devcontainers/base:debian", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: mcr.microsoft.com/vscode/devcontainers/base:debian"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-42222223b4a3450e", "name": "Dockerfile pipes a remote installer into a shell", "shortDescription": {"text": "Dockerfile pipes a remote installer into a shell"}, "fullDescription": {"text": "Executing downloaded code during image build gives the remote endpoint build-time code execution. Prefer pinned packages or verify downloaded installers by checksum/signature."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d2b8025b16bc0359", "name": "Insecure pattern 'weak_hash' in scripts/test-geodesic-prebuilt.sh:120", "shortDescription": {"text": "Insecure pattern 'weak_hash' in scripts/test-geodesic-prebuilt.sh:120"}, "fullDescription": {"text": "Found a known-risky pattern (weak_hash). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dd93867d6a8bd0bb", "name": "Possible secret in .github/workflows/build.yml", "shortDescription": {"text": "Possible secret in .github/workflows/build.yml"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-2bd0f05870783b82", "name": "Insecure pattern 'weak_hash' in pkg/convert/id_test.go:22", "shortDescription": {"text": "Insecure pattern 'weak_hash' in pkg/convert/id_test.go:22"}, "fullDescription": {"text": "Found a known-risky pattern (weak_hash). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ba378537f7202d95", "name": "Insecure pattern 'weak_hash' in pkg/auth/providers/aws/sso_cache.go:4", "shortDescription": {"text": "Insecure pattern 'weak_hash' in pkg/auth/providers/aws/sso_cache.go:4"}, "fullDescription": {"text": "Found a known-risky pattern (weak_hash). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-583eda236d7ded83", "name": "Possible secret in pkg/io/context_test.go", "shortDescription": {"text": "Possible secret in pkg/io/context_test.go"}, "fullDescription": {"text": "Detected pattern matching github_token. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-67463cb9ecca0d23", "name": "Possible secret in pkg/io/masker_test.go", "shortDescription": {"text": "Possible secret in pkg/io/masker_test.go"}, "fullDescription": {"text": "Detected pattern matching aws_access_key. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-5541f0c89826858f", "name": "Possible secret in pkg/store/identity_test.go", "shortDescription": {"text": "Possible secret in pkg/store/identity_test.go"}, "fullDescription": {"text": "Detected pattern matching aws_access_key. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-afa208cfdebe9def", "name": "Possible secret in pkg/ai/context_test.go", "shortDescription": {"text": "Possible secret in pkg/ai/context_test.go"}, "fullDescription": {"text": "Detected pattern matching aws_access_key. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-86d76c6c7445bf7a", "name": "Possible secret in pkg/ai/agent/anthropic/client_test.go", "shortDescription": {"text": "Possible secret in pkg/ai/agent/anthropic/client_test.go"}, "fullDescription": {"text": "Detected pattern matching generic_api_key. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-f0112cd521624e9a", "name": "Possible secret in pkg/ai/agent/gemini/client_test.go", "shortDescription": {"text": "Possible secret in pkg/ai/agent/gemini/client_test.go"}, "fullDescription": {"text": "Detected pattern matching generic_api_key. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-48b8c61e8b519e1d", "name": "Possible secret in pkg/ai/agent/ollama/client_test.go", "shortDescription": {"text": "Possible secret in pkg/ai/agent/ollama/client_test.go"}, "fullDescription": {"text": "Detected pattern matching generic_api_key. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-d6bf34db2c96bf0b", "name": "Possible secret in pkg/ai/agent/base/config_test.go", "shortDescription": {"text": "Possible secret in pkg/ai/agent/base/config_test.go"}, "fullDescription": {"text": "Detected pattern matching generic_api_key. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-546d7b68793e9531", "name": "Possible secret in pkg/ai/agent/openai/client_test.go", "shortDescription": {"text": "Possible secret in pkg/ai/agent/openai/client_test.go"}, "fullDescription": {"text": "Detected pattern matching generic_api_key. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-ba269c2de069d0c7", "name": "Possible secret in pkg/ai/agent/grok/client_test.go", "shortDescription": {"text": "Possible secret in pkg/ai/agent/grok/client_test.go"}, "fullDescription": {"text": "Detected pattern matching generic_api_key. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-33e86a374d5d809c", "name": "Possible secret in pkg/ai/agent/azureopenai/client_test.go", "shortDescription": {"text": "Possible secret in pkg/ai/agent/azureopenai/client_test.go"}, "fullDescription": {"text": "Detected pattern matching generic_api_key. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-ccaca2b4d7eb893c", "name": "Possible secret in website/docusaurus.config.js", "shortDescription": {"text": "Possible secret in website/docusaurus.config.js"}, "fullDescription": {"text": "Detected pattern matching generic_api_key. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-4b2c95b71efa19bb", "name": "Insecure pattern 'node_child_process' in website/plugins/blog-release-data/index.js:11", "shortDescription": {"text": "Insecure pattern 'node_child_process' in website/plugins/blog-release-data/index.js:11"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bd59f6a539687d47", "name": "Insecure pattern 'node_child_process' in website/plugins/doc-release-data/index.js:15", "shortDescription": {"text": "Insecure pattern 'node_child_process' in website/plugins/doc-release-data/index.js:15"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-62b07554b7f0cf3d", "name": "Insecure pattern 'node_child_process' in website/scripts/update-blog-releases.js:13", "shortDescription": {"text": "Insecure pattern 'node_child_process' in website/scripts/update-blog-releases.js:13"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f74d573975168e0b", "name": "Insecure pattern 'dangerous_innerhtml' in website/src/theme/AnnouncementBar/index.tsx:36", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in website/src/theme/AnnouncementBar/index.tsx:36"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f7bf429f20731f22", "name": "Insecure pattern 'dangerous_innerhtml' in website/src/components/Screengrab/index.tsx:28", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in website/src/components/Screengrab/index.tsx:28"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8efda0df20efbe86", "name": "Insecure pattern 'dangerous_innerhtml' in website/src/components/Glossary/Glossary.tsx:41", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in website/src/components/Glossary/Glossary.tsx:41"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8f2870cbc2920fc9", "name": "Insecure pattern 'document_write' in website/src/components/SlideDeck/SlideNotesPopout.tsx:165", "shortDescription": {"text": "Insecure pattern 'document_write' in website/src/components/SlideDeck/SlideNotesPopout.tsx:165"}, "fullDescription": {"text": "Found a known-risky pattern (document_write). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-56eecdbc7f14fe52", "name": "Insecure pattern 'direct_innerhtml_assignment' in website/src/components/DefinitionLinkHandler/index.js:25", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in website/src/components/DefinitionLinkHandler/index.js:25"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b829554b2ad5c9e1", "name": "Insecure pattern 'cors_wildcard' in internal/exec/terraform_plan_diff_test.go:437", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in internal/exec/terraform_plan_diff_test.go:437"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6c8f3abf1085e9c3", "name": "Insecure pattern 'weak_hash' in internal/terraform_backend/terraform_backend_s3_test.go:5", "shortDescription": {"text": "Insecure pattern 'weak_hash' in internal/terraform_backend/terraform_backend_s3_test.go:5"}, "fullDescription": {"text": "Found a known-risky pattern (weak_hash). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6b77583e1f694446", "name": "Insecure pattern 'weak_hash' in internal/terraform_backend/terraform_backend_s3.go:5", "shortDescription": {"text": "Insecure pattern 'weak_hash' in internal/terraform_backend/terraform_backend_s3.go:5"}, "fullDescription": {"text": "Found a known-risky pattern (weak_hash). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e1f3b6a0477a2e3f", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dce11a688d4c3b3f", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "aws-actions/configure-aws-credentials@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5f059860733a72fa", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2c04cdd21c27cfa3", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "aws-actions/configure-aws-credentials@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2f8657d4b27213e4", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-54b95b9a448d2cac", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-node@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-61a1a61a5214d62e", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-go@v5 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9e836d5a564a796c", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "lycheeverse/lychee-action@v2 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a68797ee0509e5b5", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "aws-actions/configure-aws-credentials@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-685e54a39110c3ba", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dad199ada0774f37", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0912b6b31ae6454f", "name": "GitHub Action tracks a moving branch", "shortDescription": {"text": "GitHub Action tracks a moving branch"}, "fullDescription": {"text": "cloudposse/.github/.github/workflows/shared-go-auto-release.yml@main can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b6bc569271317fe2", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3823ea44a3f67313", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "jaxxstorm/action-install-gh-release@v2.1.0 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2383fd133281395f", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7efbda965f283c17", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-go@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-122306d0275ca17c", "name": "GitHub Action tracks a moving branch", "shortDescription": {"text": "GitHub Action tracks a moving branch"}, "fullDescription": {"text": "hashicorp/setup-packer@main can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "high", "confidence": 1.0}}, {"id": "scanner-65aa740cba4a4a73", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "github/codeql-action/init@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a3990e7214f4a9b0", "name": "GitHub Action tracks a moving branch", "shortDescription": {"text": "GitHub Action tracks a moving branch"}, "fullDescription": {"text": "cloudposse/.github/.github/workflows/shared-go-auto-release.yml@main can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "high", "confidence": 1.0}}, {"id": "scanner-72a894be8f5f2778", "name": "GitHub Action tracks a moving branch", "shortDescription": {"text": "GitHub Action tracks a moving branch"}, "fullDescription": {"text": "cloudposse/.github/.github/workflows/shared-release-branches.yml@main can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b769174c9fcf8ea8", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2305a8d87fbc1767", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-node@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-47b88ffa7bfb67e2", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-47d3056e2ebb1aff", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-go@v5 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cf3cc905a18c9d50", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-go@v5 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6f6dcd67c0499fc4", "name": "tj-actions/changed-files is tag-pinned instead of SHA-pinned", "shortDescription": {"text": "tj-actions/changed-files is tag-pinned instead of SHA-pinned"}, "fullDescription": {"text": "The tj-actions/changed-files incident showed that mutable action tags can execute credential-stealing code across many repositories. Pin this action to a reviewed commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "high", "confidence": 1.0}}, {"id": "scanner-90d9d3dad32591dc", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "jaxxstorm/action-install-gh-release@v1.14.0 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-228b5f3176785737", "name": "Very large file: tests/cli_test.go (1947 lines)", "shortDescription": {"text": "Very large file: tests/cli_test.go (1947 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a8ef31e7c404fa0d", "name": "Very large file: tests/cli_locals_test.go (1405 lines)", "shortDescription": {"text": "Very large file: tests/cli_locals_test.go (1405 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c09f6983514bc34c", "name": "Very large file: pkg/terraform/output/executor_test.go (2413 lines)", "shortDescription": {"text": "Very large file: pkg/terraform/output/executor_test.go (2413 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ac9358c4353d2821", "name": "Very large file: pkg/workflow/executor_test.go (1769 lines)", "shortDescription": {"text": "Very large file: pkg/workflow/executor_test.go (1769 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2349464b9985b615", "name": "Very large file: pkg/ci/plugins/terraform/handlers_test.go (1655 lines)", "shortDescription": {"text": "Very large file: pkg/ci/plugins/terraform/handlers_test.go (1655 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e412e7b51ab0d08d", "name": "Very large file: pkg/utils/yaml_utils_test.go (1680 lines)", "shortDescription": {"text": "Very large file: pkg/utils/yaml_utils_test.go (1680 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ddc68af9be043c3b", "name": "Very large file: pkg/auth/manager_test.go (2229 lines)", "shortDescription": {"text": "Very large file: pkg/auth/manager_test.go (2229 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1e73a18f427f4cc6", "name": "Very large file: pkg/auth/manager_helpers_test.go (1465 lines)", "shortDescription": {"text": "Very large file: pkg/auth/manager_helpers_test.go (1465 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b71a2db54c5beabc", "name": "Very large file: pkg/auth/identities/aws/user_test.go (2610 lines)", "shortDescription": {"text": "Very large file: pkg/auth/identities/aws/user_test.go (2610 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-24af3c3f55a0669c", "name": "Very large file: pkg/auth/identities/aws/webflow_browser_test.go (2148 lines)", "shortDescription": {"text": "Very large file: pkg/auth/identities/aws/webflow_browser_test.go (2148 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f0ef6f79ab07b453", "name": "Very large file: pkg/auth/identities/aws/assume_root_test.go (1914 lines)", "shortDescription": {"text": "Very large file: pkg/auth/identities/aws/assume_root_test.go (1914 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c7122f051dc4a04e", "name": "Very large file: pkg/auth/identities/aws/assume_role_test.go (1759 lines)", "shortDescription": {"text": "Very large file: pkg/auth/identities/aws/assume_role_test.go (1759 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e829f994a41e1d1e", "name": "Very large file: pkg/version/reexec_test.go (1642 lines)", "shortDescription": {"text": "Very large file: pkg/version/reexec_test.go (1642 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3a5ca14d832f107f", "name": "Very large file: pkg/dependencies/installer_test.go (1678 lines)", "shortDescription": {"text": "Very large file: pkg/dependencies/installer_test.go (1678 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a5cbeff4dd99c4ec", "name": "Very large file: pkg/schema/schema.go (1468 lines)", "shortDescription": {"text": "Very large file: pkg/schema/schema.go (1468 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-64d9cb6bf60c31a7", "name": "Very large file: pkg/toolchain/set_test.go (1819 lines)", "shortDescription": {"text": "Very large file: pkg/toolchain/set_test.go (1819 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-83b51f48a360864d", "name": "Very large file: pkg/toolchain/registry/aqua/aqua_test.go (3090 lines)", "shortDescription": {"text": "Very large file: pkg/toolchain/registry/aqua/aqua_test.go (3090 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4ab1627f8fb4a36c", "name": "Very large file: pkg/config/load_test.go (1885 lines)", "shortDescription": {"text": "Very large file: pkg/config/load_test.go (1885 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d602fdef45bad8c6", "name": "Very large file: pkg/config/load.go (1523 lines)", "shortDescription": {"text": "Very large file: pkg/config/load.go (1523 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-09f10dd8ba06f56c", "name": "Very large file: pkg/ai/agent/anthropic/client_test.go (2197 lines)", "shortDescription": {"text": "Very large file: pkg/ai/agent/anthropic/client_test.go (2197 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0625f86268a8068b", "name": "Very large file: pkg/ai/agent/bedrock/client_test.go (2088 lines)", "shortDescription": {"text": "Very large file: pkg/ai/agent/bedrock/client_test.go (2088 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b5c010e53301a085", "name": "Very large file: pkg/ai/tui/chat_test.go (3731 lines)", "shortDescription": {"text": "Very large file: pkg/ai/tui/chat_test.go (3731 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cf8f338c00a24bd2", "name": "Very large file: pkg/ai/tui/chat_helpers_test.go (3405 lines)", "shortDescription": {"text": "Very large file: pkg/ai/tui/chat_helpers_test.go (3405 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6ada5b7da5426323", "name": "Very large file: pkg/http/client_test.go (1427 lines)", "shortDescription": {"text": "Very large file: pkg/http/client_test.go (1427 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b6f6d1157fc7ac8b", "name": "Very large file: pkg/scheduler/adapters/terraform_test.go (1770 lines)", "shortDescription": {"text": "Very large file: pkg/scheduler/adapters/terraform_test.go (1770 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7674ef06c6085bc9", "name": "Very large file: pkg/ui/formatter_test.go (2343 lines)", "shortDescription": {"text": "Very large file: pkg/ui/formatter_test.go (2343 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-edae251e4993898f", "name": "Very large file: internal/exec/workflow_utils_test.go (1696 lines)", "shortDescription": {"text": "Very large file: internal/exec/workflow_utils_test.go (1696 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c694466ffe768b4b", "name": "Very large file: internal/exec/describe_stacks_component_processor_test.go (1516 lines)", "shortDescription": {"text": "Very large file: internal/exec/describe_stacks_component_processor_test.go (1516 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6792865021e31d70", "name": "Very large file: internal/exec/terraform_utils_test.go (2621 lines)", "shortDescription": {"text": "Very large file: internal/exec/terraform_utils_test.go (2621 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e244a0f6e1903fb6", "name": "Very large file: internal/exec/describe_affected_optimizations_test.go (2536 lines)", "shortDescription": {"text": "Very large file: internal/exec/describe_affected_optimizations_test.go (2536 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3c9a485571628907", "name": "Very large file: internal/exec/stack_processor_utils_test.go (4315 lines)", "shortDescription": {"text": "Very large file: internal/exec/stack_processor_utils_test.go (4315 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5b29a367f2ed69a7", "name": "Very large file: internal/exec/stack_manifest_name_test.go (1262 lines)", "shortDescription": {"text": "Very large file: internal/exec/stack_manifest_name_test.go (1262 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-acbc4227dda1a838", "name": "Very large file: internal/exec/cli_utils_test.go (2192 lines)", "shortDescription": {"text": "Very large file: internal/exec/cli_utils_test.go (2192 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8238a4e4f7b94379", "name": "Very large file: internal/exec/stack_processor_utils.go (2515 lines)", "shortDescription": {"text": "Very large file: internal/exec/stack_processor_utils.go (2515 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6a718b3b1060ab4f", "name": "Very large file: internal/exec/terraform_plan_diff_test.go (1971 lines)", "shortDescription": {"text": "Very large file: internal/exec/terraform_plan_diff_test.go (1971 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ffd3db58edf2e7f6", "name": "Very large file: internal/exec/describe_affected_utils_test.go (2055 lines)", "shortDescription": {"text": "Very large file: internal/exec/describe_affected_utils_test.go (2055 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2a4dc86a95e90779", "name": "Very large file: internal/exec/describe_affected_test.go (2402 lines)", "shortDescription": {"text": "Very large file: internal/exec/describe_affected_test.go (2402 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f9389f6e50090bba", "name": "Very large file: errors/errors.go (1193 lines)", "shortDescription": {"text": "Very large file: errors/errors.go (1193 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c48e9b7e9cc3c0ec", "name": "Very large file: cmd/cmd_utils_test.go (2212 lines)", "shortDescription": {"text": "Very large file: cmd/cmd_utils_test.go (2212 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-181023d039498b62", "name": "Very large file: cmd/cmd_utils.go (1683 lines)", "shortDescription": {"text": "Very large file: cmd/cmd_utils.go (1683 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e8035273a7ca491b", "name": "Very large file: cmd/root.go (1990 lines)", "shortDescription": {"text": "Very large file: cmd/root.go (1990 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c200fbdc22b33b78", "name": "Very large file: cmd/custom_command_flag_conflict_test.go (1508 lines)", "shortDescription": {"text": "Very large file: cmd/custom_command_flag_conflict_test.go (1508 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c1a7a4ea8b8e1bbf", "name": "Very large file: cmd/mcp/server/start_test.go (3461 lines)", "shortDescription": {"text": "Very large file: cmd/mcp/server/start_test.go (3461 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bb5eccdd814219e6", "name": "Very large file: cmd/ai/chat_test.go (2213 lines)", "shortDescription": {"text": "Very large file: cmd/ai/chat_test.go (2213 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-36687fed1c614763", "name": "Very large file: cmd/ai/ask_test.go (2309 lines)", "shortDescription": {"text": "Very large file: cmd/ai/ask_test.go (2309 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5a532f68b29d02ca", "name": "Very large file: cmd/ai/sessions_test.go (3921 lines)", "shortDescription": {"text": "Very large file: cmd/ai/sessions_test.go (3921 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a14b4a5b3ab4513f", "name": "Very large file: cmd/ai/exec_test.go (3407 lines)", "shortDescription": {"text": "Very large file: cmd/ai/exec_test.go (3407 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d53e6fc6e96b42a4", "name": "43 TODO/FIXME markers", "shortDescription": {"text": "43 TODO/FIXME markers"}, "fullDescription": {"text": "High count of TODO/FIXME/HACK markers \u2014 track them as issues so they're not forgotten."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 55 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 4352 placeholder/mock markers across 547 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9d79c4077342a7d0", "name": "Runtime service client appears to use placeholder configuration", "shortDescription": {"text": "Runtime service client appears to use placeholder configuration"}, "fullDescription": {"text": "A runtime source file appears to wire Supabase/Firebase/AI/payment-style clients to placeholder URLs, keys, or fallback values. In the Fable corpus this often means the UI/API shape is present while the backend service is not actually configured."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bea357a6497a2d5d", "name": "Agent authority lacks a verifier contract: CLAUDE.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: CLAUDE.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b58b30d03bc071b4", "name": "Agent authority lacks a verifier contract: gists/mcp-with-aws/.mcp.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: gists/mcp-with-aws/.mcp.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2628b6ff2a14bc49", "name": "Agent authority lacks a verifier contract: agent-skills/skills/atmos-helmfile/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: agent-skills/skills/atmos-helmfile/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a931b2b72be7534f", "name": "Agent instruction/config may expose a secret: agent-skills/skills/atmos-config/SKILL.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: agent-skills/skills/atmos-config/SKILL.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-06dfa4d96cdb9a80", "name": "Agent authority lacks a verifier contract: agent-skills/skills/atmos-config/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: agent-skills/skills/atmos-config/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0f9b9b894fae687b", "name": "Agent instruction/config may expose a secret: agent-skills/skills/atmos-auth/SKILL.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: agent-skills/skills/atmos-auth/SKILL.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7c34099155a06e46", "name": "Agent authority lacks a verifier contract: agent-skills/skills/atmos-auth/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: agent-skills/skills/atmos-auth/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7b883defb217076a", "name": "Agent instruction/config may expose a secret: agent-skills/skills/atmos-gitops/SKILL.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: agent-skills/skills/atmos-gitops/SKILL.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f2c11a8467e69177", "name": "Agent authority lacks a verifier contract: agent-skills/skills/atmos-introspection/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: agent-skills/skills/atmos-introspection/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ed47439f934998fb", "name": "Agent authority lacks a verifier contract: agent-skills/skills/atmos-aws-security/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: agent-skills/skills/atmos-aws-security/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c90c5fdcf05cbb98", "name": "Agent instruction/config may expose a secret: agent-skills/skills/atmos-terraform/SKILL.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: agent-skills/skills/atmos-terraform/SKILL.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-68421ac74f61351e", "name": "Agent authority lacks a verifier contract: agent-skills/skills/atmos-terraform/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: agent-skills/skills/atmos-terraform/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-92def1d4807195cc", "name": "Agent authority lacks a verifier contract: agent-skills/skills/atmos-yaml-functions/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: agent-skills/skills/atmos-yaml-functions/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8aa73b852023621e", "name": "Agent authority lacks a verifier contract: agent-skills/skills/atmos-vendoring/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: agent-skills/skills/atmos-vendoring/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-95236d528c135505", "name": "Agent instruction/config may expose a secret: agent-skills/skills/atmos-stores/SKILL.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: agent-skills/skills/atmos-stores/SKILL.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-453195d2681910bc", "name": "Agent authority lacks a verifier contract: agent-skills/skills/atmos-stores/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: agent-skills/skills/atmos-stores/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8f6d508c9d48fa9e", "name": "Agent authority lacks a verifier contract: .claude/skills/speckit-git-validate/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/speckit-git-validate/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c3b5bcae91be5465", "name": "Agent authority lacks a verifier contract: .claude/skills/speckit-plan/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/speckit-plan/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-68dfac0dc0956dd3", "name": "Agent authority lacks a verifier contract: .claude/skills/speckit-git-remote/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/speckit-git-remote/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ac8564ae12d191fd", "name": "Agent authority lacks a verifier contract: .claude/skills/speckit-git-commit/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/speckit-git-commit/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-373517c18f0b0dbb", "name": "Agent authority lacks a verifier contract: .claude/skills/speckit-checklist/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/speckit-checklist/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8492bc3758ab49c6", "name": "Agent authority lacks a verifier contract: .claude/skills/speckit-clarify/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/speckit-clarify/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-78ac78bc4ff3cf46", "name": "Agent authority lacks a verifier contract: .claude/skills/speckit-taskstoissues/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/speckit-taskstoissues/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8d996699d6c06141", "name": "Agent authority lacks a verifier contract: .claude/skills/speckit-git-initialize/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/speckit-git-initialize/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3f97467cb715b992", "name": "`fetch()` without try/.catch or AbortSignal \u2014 .github/actions/verify-sha-pinning/test.mjs:26", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 .github/actions/verify-sha-pinning/test.mjs:26"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e1de93098d606faa", "name": "`fetch()` without try/.catch or AbortSignal \u2014 website/plugins/fetch-github-stars/index.js:12", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 website/plugins/fetch-github-stars/index.js:12"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f7e98eea697a35fd", "name": "Commented-code block (5 lines) in website/plugins/docusaurus-plugin-llms-txt/src/mdx-normalize.mjs:321", "shortDescription": {"text": "Commented-code block (5 lines) in website/plugins/docusaurus-plugin-llms-txt/src/mdx-normalize.mjs:321"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ed6f86161f5f1857", "name": "Commented-code block (5 lines) in website/plugins/docusaurus-plugin-llms-txt/src/mdx-normalize.test.mjs:142", "shortDescription": {"text": "Commented-code block (5 lines) in website/plugins/docusaurus-plugin-llms-txt/src/mdx-normalize.test.mjs:142"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9d4a188aca4e0b6e", "name": "Commented-code block (5 lines) in website/plugins/doc-release-data/index.js:188", "shortDescription": {"text": "Commented-code block (5 lines) in website/plugins/doc-release-data/index.js:188"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a514dbafa3ed87aa", "name": "`fetch()` without try/.catch or AbortSignal \u2014 website/src/components/Glossary/Glossary.tsx:16", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 website/src/components/Glossary/Glossary.tsx:16"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-aabdb8e6ceeccc46", "name": "Legacy-named symbol `widget__copy` in website/src/components/InstallWidget/index.tsx:81", "shortDescription": {"text": "Legacy-named symbol `widget__copy` in website/src/components/InstallWidget/index.tsx:81"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/25021"}, "properties": {"repository": "cloudposse/atmos", "repoUrl": "https://github.com/cloudposse/atmos", "branch": "main"}, "results": [{"ruleId": "scanner-25ee461c4febb44d", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 website/plugins/file-browser/index.js:520"}, "properties": {"repobilityId": "6a521c5a5847d90e", "scanner": "scanner-primary", "fingerprint": "25ee461c4febb44d", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-cfb78206a9c94e2e", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 website/plugins/docusaurus-plugin-llms-txt/src/index.js:149"}, "properties": {"repobilityId": "8cae4701e05f5edf", "scanner": "scanner-primary", "fingerprint": "cfb78206a9c94e2e", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-116d848780f3c42c", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 website/plugins/blog-release-data/index.js:146"}, "properties": {"repobilityId": "b61661adb50b3e2b", "scanner": "scanner-primary", "fingerprint": "116d848780f3c42c", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-4105ad5a90a148ee", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 website/plugins/slide-notes-extractor/index.js:13"}, "properties": {"repobilityId": "25bb423e52607e94", "scanner": "scanner-primary", "fingerprint": "4105ad5a90a148ee", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-56da1e5de0646d34", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 website/plugins/doc-release-data/index.js:244"}, "properties": {"repobilityId": "6fcc5db5df196d46", "scanner": "scanner-primary", "fingerprint": "56da1e5de0646d34", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-0673c6764aae87d6", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 website/scripts/update-blog-releases.js:28"}, "properties": {"repobilityId": "e6342a52fc0b99f7", "scanner": "scanner-primary", "fingerprint": "0673c6764aae87d6", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-b851087392c6114c", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 website/src/theme/AnnouncementBar/index.tsx:36"}, "properties": {"repobilityId": "106a735652a29010", "scanner": "scanner-primary", "fingerprint": "b851087392c6114c", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-6eb62463af760c03", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 website/src/theme/Navbar/Content/index.tsx:23"}, "properties": {"repobilityId": "e13880c98e676c28", "scanner": "scanner-primary", "fingerprint": "6eb62463af760c03", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-066dd828db697aef", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 website/src/components/Screengrab/index.tsx:28"}, "properties": {"repobilityId": "ed3b615014575b52", "scanner": "scanner-primary", "fingerprint": "066dd828db697aef", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-22b3eb8ffa5069d8", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 website/src/components/Glossary/Glossary.tsx:41"}, "properties": {"repobilityId": "1568a1a0922fe6a9", "scanner": "scanner-primary", "fingerprint": "22b3eb8ffa5069d8", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-7e6329c3b7b74f2f", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 website/src/components/Definition/index.js:12"}, "properties": {"repobilityId": "0e12641d73124560", "scanner": "scanner-primary", "fingerprint": "7e6329c3b7b74f2f", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-715f773c0b2dbddd", "level": "warning", "message": {"text": "Privileged port 20 in use"}, "properties": {"repobilityId": "a59f3e53d617e0f8", "scanner": "scanner-primary", "fingerprint": "715f773c0b2dbddd", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/test-cases/auth-mock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f772d2e522360523", "level": "warning", "message": {"text": "Privileged port 57 in use"}, "properties": {"repobilityId": "7f473bea32892301", "scanner": "scanner-primary", "fingerprint": "f772d2e522360523", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/test-cases/auth-mock.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d9a28a1c77374c88", "level": "warning", "message": {"text": "Privileged port 15 in use"}, "properties": {"repobilityId": "3340f9a170f285cd", "scanner": "scanner-primary", "fingerprint": "d9a28a1c77374c88", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/nightlybuilds.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bed517b6daf4be7d", "level": "warning", "message": {"text": "Privileged port 12 in use"}, "properties": {"repobilityId": "65e7eefa33f2def4", "scanner": "scanner-primary", "fingerprint": "bed517b6daf4be7d", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/nightlybuilds.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d63da3583b14afc0", "level": "warning", "message": {"text": "Dockerfile runs as root: Dockerfile"}, "properties": {"repobilityId": "a2ed1bd120e507db", "scanner": "scanner-primary", "fingerprint": "d63da3583b14afc0", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-84019dfd8d98a34d", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: debian:bookworm-slim"}, "properties": {"repobilityId": "264bcb1ad621ab27", "scanner": "scanner-primary", "fingerprint": "84019dfd8d98a34d", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-5072990f20615d2b", "level": "warning", "message": {"text": "Dockerfile runs as root: demo/screenshots/Dockerfile"}, "properties": {"repobilityId": "cc45c20ecd44695b", "scanner": "scanner-primary", "fingerprint": "5072990f20615d2b", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-eafce6eea61f96fc", "level": "warning", "message": {"text": "Docker base image uses a mutable or implicit tag: ghcr.io/charmbracelet/vhs:latest"}, "properties": {"repobilityId": "17bf5ca3dc4944a9", "scanner": "scanner-primary", "fingerprint": "eafce6eea61f96fc", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "demo/screenshots/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f92512b7ef328c83", "level": "warning", "message": {"text": "Dockerfile ADD downloads remote content without checksum"}, "properties": {"repobilityId": "05d543bd17ea68dc", "scanner": "scanner-primary", "fingerprint": "f92512b7ef328c83", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "docker", "checksum"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "demo/screenshots/Dockerfile"}, "region": {"startLine": 9}}}]}, {"ruleId": "scanner-fb597e8cf907faaf", "level": "warning", "message": {"text": "Dockerfile runs as root: examples/devcontainer-build/Dockerfile"}, "properties": {"repobilityId": "af911567ade12e15", "scanner": "scanner-primary", "fingerprint": "fb597e8cf907faaf", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-edb081c23d5d4d84", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: cloudposse/geodesic:${GEODESIC_VERSION}"}, "properties": {"repobilityId": "4e15f86bb16b22b4", "scanner": "scanner-primary", "fingerprint": "edb081c23d5d4d84", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/devcontainer-build/Dockerfile"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-70d998bbfb991814", "level": "error", "message": {"text": "Dockerfile pipes a remote installer into a shell"}, "properties": {"repobilityId": "b562edc9d31ee2d7", "scanner": "scanner-primary", "fingerprint": "70d998bbfb991814", "layer": "hardware", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "docker", "remote-installer"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/devcontainer-build/Dockerfile"}, "region": {"startLine": 9}}}]}, {"ruleId": "scanner-0a5c2287e2b85e4b", "level": "warning", "message": {"text": "Dockerfile runs as root: examples/quick-start-advanced/Dockerfile"}, "properties": {"repobilityId": "443c057670af0e8f", "scanner": "scanner-primary", "fingerprint": "0a5c2287e2b85e4b", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-790c4d4441a66e2a", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: cloudposse/geodesic:${GEODESIC_VERSION}-${GEODESIC_OS}"}, "properties": {"repobilityId": "0a9f97cc9540500b", "scanner": "scanner-primary", "fingerprint": "790c4d4441a66e2a", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/quick-start-advanced/Dockerfile"}, "region": {"startLine": 13}}}]}, {"ruleId": "scanner-4a210ac3b4b59ff4", "level": "warning", "message": {"text": "Dockerfile runs as root: .devcontainer/Dockerfile"}, "properties": {"repobilityId": "7855b1f55d0800cf", "scanner": "scanner-primary", "fingerprint": "4a210ac3b4b59ff4", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-369acff355c0d994", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: golang:1.26.2"}, "properties": {"repobilityId": "36466435a689a900", "scanner": "scanner-primary", "fingerprint": "369acff355c0d994", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".devcontainer/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-214deb501ac69f4f", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: mcr.microsoft.com/vscode/devcontainers/base:debian"}, "properties": {"repobilityId": "cef18b0023edfde9", "scanner": "scanner-primary", "fingerprint": "214deb501ac69f4f", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".devcontainer/Dockerfile"}, "region": {"startLine": 8}}}]}, {"ruleId": "scanner-42222223b4a3450e", "level": "error", "message": {"text": "Dockerfile pipes a remote installer into a shell"}, "properties": {"repobilityId": "e7101a3eebd27c72", "scanner": "scanner-primary", "fingerprint": "42222223b4a3450e", "layer": "hardware", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "docker", "remote-installer"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".devcontainer/Dockerfile"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-42222223b4a3450e", "level": "error", "message": {"text": "Dockerfile pipes a remote installer into a shell"}, "properties": {"repobilityId": "1623fe73f23f2f3a", "scanner": "scanner-primary", "fingerprint": "42222223b4a3450e", "layer": "hardware", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "docker", "remote-installer"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".devcontainer/Dockerfile"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-42222223b4a3450e", "level": "error", "message": {"text": "Dockerfile pipes a remote installer into a shell"}, "properties": {"repobilityId": "1af0244e8621ceef", "scanner": "scanner-primary", "fingerprint": "42222223b4a3450e", "layer": "hardware", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "docker", "remote-installer"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".devcontainer/Dockerfile"}, "region": {"startLine": 37}}}]}, {"ruleId": "scanner-42222223b4a3450e", "level": "error", "message": {"text": "Dockerfile pipes a remote installer into a shell"}, "properties": {"repobilityId": "d9ef4a904dce8664", "scanner": "scanner-primary", "fingerprint": "42222223b4a3450e", "layer": "hardware", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "docker", "remote-installer"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".devcontainer/Dockerfile"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-d2b8025b16bc0359", "level": "warning", "message": {"text": "Insecure pattern 'weak_hash' in scripts/test-geodesic-prebuilt.sh:120"}, "properties": {"repobilityId": "4d85baf583bb77d4", "scanner": "scanner-primary", "fingerprint": "d2b8025b16bc0359", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "weak_hash"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/test-geodesic-prebuilt.sh"}, "region": {"startLine": 120}}}]}, {"ruleId": "scanner-dd93867d6a8bd0bb", "level": "error", "message": {"text": "Possible secret in .github/workflows/build.yml"}, "properties": {"repobilityId": "22a23f6425b9566d", "scanner": "scanner-primary", "fingerprint": "dd93867d6a8bd0bb", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build.yml"}, "region": {"startLine": 59}}}]}, {"ruleId": "scanner-2bd0f05870783b82", "level": "warning", "message": {"text": "Insecure pattern 'weak_hash' in pkg/convert/id_test.go:22"}, "properties": {"repobilityId": "d2ecb9d68e9e586b", "scanner": "scanner-primary", "fingerprint": "2bd0f05870783b82", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "weak_hash"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/convert/id_test.go"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-ba378537f7202d95", "level": "warning", "message": {"text": "Insecure pattern 'weak_hash' in pkg/auth/providers/aws/sso_cache.go:4"}, "properties": {"repobilityId": "6e3a7c6f3506e2ba", "scanner": "scanner-primary", "fingerprint": "ba378537f7202d95", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "weak_hash"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/auth/providers/aws/sso_cache.go"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-583eda236d7ded83", "level": "error", "message": {"text": "Possible secret in pkg/io/context_test.go"}, "properties": {"repobilityId": "4d69416a5c32882c", "scanner": "scanner-primary", "fingerprint": "583eda236d7ded83", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/io/context_test.go"}, "region": {"startLine": 339}}}]}, {"ruleId": "scanner-583eda236d7ded83", "level": "error", "message": {"text": "Possible secret in pkg/io/context_test.go"}, "properties": {"repobilityId": "fc47e9956a99e1f4", "scanner": "scanner-primary", "fingerprint": "583eda236d7ded83", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/io/context_test.go"}, "region": {"startLine": 349}}}]}, {"ruleId": "scanner-583eda236d7ded83", "level": "error", "message": {"text": "Possible secret in pkg/io/context_test.go"}, "properties": {"repobilityId": "9517c0f1cac1e602", "scanner": "scanner-primary", "fingerprint": "583eda236d7ded83", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/io/context_test.go"}, "region": {"startLine": 359}}}]}, {"ruleId": "scanner-67463cb9ecca0d23", "level": "error", "message": {"text": "Possible secret in pkg/io/masker_test.go"}, "properties": {"repobilityId": "f9d4f8d7475c26d0", "scanner": "scanner-primary", "fingerprint": "67463cb9ecca0d23", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/io/masker_test.go"}, "region": {"startLine": 173}}}]}, {"ruleId": "scanner-5541f0c89826858f", "level": "error", "message": {"text": "Possible secret in pkg/store/identity_test.go"}, "properties": {"repobilityId": "35499eb969b2eb5d", "scanner": "scanner-primary", "fingerprint": "5541f0c89826858f", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/store/identity_test.go"}, "region": {"startLine": 691}}}]}, {"ruleId": "scanner-afa208cfdebe9def", "level": "error", "message": {"text": "Possible secret in pkg/ai/context_test.go"}, "properties": {"repobilityId": "9b1e2286df40f919", "scanner": "scanner-primary", "fingerprint": "afa208cfdebe9def", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/ai/context_test.go"}, "region": {"startLine": 452}}}]}, {"ruleId": "scanner-86d76c6c7445bf7a", "level": "error", "message": {"text": "Possible secret in pkg/ai/agent/anthropic/client_test.go"}, "properties": {"repobilityId": "1472d3b5265ed6a8", "scanner": "scanner-primary", "fingerprint": "86d76c6c7445bf7a", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/ai/agent/anthropic/client_test.go"}, "region": {"startLine": 62}}}]}, {"ruleId": "scanner-86d76c6c7445bf7a", "level": "error", "message": {"text": "Possible secret in pkg/ai/agent/anthropic/client_test.go"}, "properties": {"repobilityId": "1472d3b5265ed6a8", "scanner": "scanner-primary", "fingerprint": "86d76c6c7445bf7a", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/ai/agent/anthropic/client_test.go"}, "region": {"startLine": 71}}}]}, {"ruleId": "scanner-86d76c6c7445bf7a", "level": "error", "message": {"text": "Possible secret in pkg/ai/agent/anthropic/client_test.go"}, "properties": {"repobilityId": "1472d3b5265ed6a8", "scanner": "scanner-primary", "fingerprint": "86d76c6c7445bf7a", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/ai/agent/anthropic/client_test.go"}, "region": {"startLine": 1064}}}]}, {"ruleId": "scanner-f0112cd521624e9a", "level": "error", "message": {"text": "Possible secret in pkg/ai/agent/gemini/client_test.go"}, "properties": {"repobilityId": "b1e4041604881d8d", "scanner": "scanner-primary", "fingerprint": "f0112cd521624e9a", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/ai/agent/gemini/client_test.go"}, "region": {"startLine": 61}}}]}, {"ruleId": "scanner-f0112cd521624e9a", "level": "error", "message": {"text": "Possible secret in pkg/ai/agent/gemini/client_test.go"}, "properties": {"repobilityId": "b1e4041604881d8d", "scanner": "scanner-primary", "fingerprint": "f0112cd521624e9a", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/ai/agent/gemini/client_test.go"}, "region": {"startLine": 70}}}]}, {"ruleId": "scanner-f0112cd521624e9a", "level": "error", "message": {"text": "Possible secret in pkg/ai/agent/gemini/client_test.go"}, "properties": {"repobilityId": "b1e4041604881d8d", "scanner": "scanner-primary", "fingerprint": "f0112cd521624e9a", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/ai/agent/gemini/client_test.go"}, "region": {"startLine": 100}}}]}, {"ruleId": "scanner-f0112cd521624e9a", "level": "error", "message": {"text": "Possible secret in pkg/ai/agent/gemini/client_test.go"}, "properties": {"repobilityId": "b1e4041604881d8d", "scanner": "scanner-primary", "fingerprint": "f0112cd521624e9a", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/ai/agent/gemini/client_test.go"}, "region": {"startLine": 108}}}]}, {"ruleId": "scanner-48b8c61e8b519e1d", "level": "error", "message": {"text": "Possible secret in pkg/ai/agent/ollama/client_test.go"}, "properties": {"repobilityId": "7d521eee058d4dbc", "scanner": "scanner-primary", "fingerprint": "48b8c61e8b519e1d", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/ai/agent/ollama/client_test.go"}, "region": {"startLine": 39}}}]}, {"ruleId": "scanner-48b8c61e8b519e1d", "level": "error", "message": {"text": "Possible secret in pkg/ai/agent/ollama/client_test.go"}, "properties": {"repobilityId": "7d521eee058d4dbc", "scanner": "scanner-primary", "fingerprint": "48b8c61e8b519e1d", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/ai/agent/ollama/client_test.go"}, "region": {"startLine": 49}}}]}, {"ruleId": "scanner-48b8c61e8b519e1d", "level": "error", "message": {"text": "Possible secret in pkg/ai/agent/ollama/client_test.go"}, "properties": {"repobilityId": "7d521eee058d4dbc", "scanner": "scanner-primary", "fingerprint": "48b8c61e8b519e1d", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/ai/agent/ollama/client_test.go"}, "region": {"startLine": 102}}}]}, {"ruleId": "scanner-48b8c61e8b519e1d", "level": "error", "message": {"text": "Possible secret in pkg/ai/agent/ollama/client_test.go"}, "properties": {"repobilityId": "7d521eee058d4dbc", "scanner": "scanner-primary", "fingerprint": "48b8c61e8b519e1d", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/ai/agent/ollama/client_test.go"}, "region": {"startLine": 112}}}]}, {"ruleId": "scanner-d6bf34db2c96bf0b", "level": "error", "message": {"text": "Possible secret in pkg/ai/agent/base/config_test.go"}, "properties": {"repobilityId": "afd140757edaaa7c", "scanner": "scanner-primary", "fingerprint": "d6bf34db2c96bf0b", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/ai/agent/base/config_test.go"}, "region": {"startLine": 57}}}]}, {"ruleId": "scanner-546d7b68793e9531", "level": "error", "message": {"text": "Possible secret in pkg/ai/agent/openai/client_test.go"}, "properties": {"repobilityId": "d69dcc49a2f91ac0", "scanner": "scanner-primary", "fingerprint": "546d7b68793e9531", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/ai/agent/openai/client_test.go"}, "region": {"startLine": 38}}}]}, {"ruleId": "scanner-546d7b68793e9531", "level": "error", "message": {"text": "Possible secret in pkg/ai/agent/openai/client_test.go"}, "properties": {"repobilityId": "d69dcc49a2f91ac0", "scanner": "scanner-primary", "fingerprint": "546d7b68793e9531", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/ai/agent/openai/client_test.go"}, "region": {"startLine": 47}}}]}, {"ruleId": "scanner-546d7b68793e9531", "level": "error", "message": {"text": "Possible secret in pkg/ai/agent/openai/client_test.go"}, "properties": {"repobilityId": "d69dcc49a2f91ac0", "scanner": "scanner-primary", "fingerprint": "546d7b68793e9531", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/ai/agent/openai/client_test.go"}, "region": {"startLine": 337}}}]}, {"ruleId": "scanner-546d7b68793e9531", "level": "error", "message": {"text": "Possible secret in pkg/ai/agent/openai/client_test.go"}, "properties": {"repobilityId": "d69dcc49a2f91ac0", "scanner": "scanner-primary", "fingerprint": "546d7b68793e9531", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/ai/agent/openai/client_test.go"}, "region": {"startLine": 659}}}]}, {"ruleId": "scanner-ba269c2de069d0c7", "level": "error", "message": {"text": "Possible secret in pkg/ai/agent/grok/client_test.go"}, "properties": {"repobilityId": "0342279933f77d45", "scanner": "scanner-primary", "fingerprint": "ba269c2de069d0c7", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/ai/agent/grok/client_test.go"}, "region": {"startLine": 41}}}]}, {"ruleId": "scanner-ba269c2de069d0c7", "level": "error", "message": {"text": "Possible secret in pkg/ai/agent/grok/client_test.go"}, "properties": {"repobilityId": "0342279933f77d45", "scanner": "scanner-primary", "fingerprint": "ba269c2de069d0c7", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/ai/agent/grok/client_test.go"}, "region": {"startLine": 51}}}]}, {"ruleId": "scanner-ba269c2de069d0c7", "level": "error", "message": {"text": "Possible secret in pkg/ai/agent/grok/client_test.go"}, "properties": {"repobilityId": "0342279933f77d45", "scanner": "scanner-primary", "fingerprint": "ba269c2de069d0c7", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/ai/agent/grok/client_test.go"}, "region": {"startLine": 354}}}]}, {"ruleId": "scanner-33e86a374d5d809c", "level": "error", "message": {"text": "Possible secret in pkg/ai/agent/azureopenai/client_test.go"}, "properties": {"repobilityId": "65b72b95f9c48fbe", "scanner": "scanner-primary", "fingerprint": "33e86a374d5d809c", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/ai/agent/azureopenai/client_test.go"}, "region": {"startLine": 67}}}]}, {"ruleId": "scanner-33e86a374d5d809c", "level": "error", "message": {"text": "Possible secret in pkg/ai/agent/azureopenai/client_test.go"}, "properties": {"repobilityId": "65b72b95f9c48fbe", "scanner": "scanner-primary", "fingerprint": "33e86a374d5d809c", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/ai/agent/azureopenai/client_test.go"}, "region": {"startLine": 77}}}]}, {"ruleId": "scanner-33e86a374d5d809c", "level": "error", "message": {"text": "Possible secret in pkg/ai/agent/azureopenai/client_test.go"}, "properties": {"repobilityId": "65b72b95f9c48fbe", "scanner": "scanner-primary", "fingerprint": "33e86a374d5d809c", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/ai/agent/azureopenai/client_test.go"}, "region": {"startLine": 131}}}]}, {"ruleId": "scanner-33e86a374d5d809c", "level": "error", "message": {"text": "Possible secret in pkg/ai/agent/azureopenai/client_test.go"}, "properties": {"repobilityId": "65b72b95f9c48fbe", "scanner": "scanner-primary", "fingerprint": "33e86a374d5d809c", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/ai/agent/azureopenai/client_test.go"}, "region": {"startLine": 140}}}]}, {"ruleId": "scanner-ccaca2b4d7eb893c", "level": "error", "message": {"text": "Possible secret in website/docusaurus.config.js"}, "properties": {"repobilityId": "47488fb3256472a7", "scanner": "scanner-primary", "fingerprint": "ccaca2b4d7eb893c", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "website/docusaurus.config.js"}, "region": {"startLine": 386}}}]}, {"ruleId": "scanner-4b2c95b71efa19bb", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in website/plugins/blog-release-data/index.js:11"}, "properties": {"repobilityId": "e5f30138944b11ee", "scanner": "scanner-primary", "fingerprint": "4b2c95b71efa19bb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "website/plugins/blog-release-data/index.js"}, "region": {"startLine": 11}}}]}, {"ruleId": "scanner-bd59f6a539687d47", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in website/plugins/doc-release-data/index.js:15"}, "properties": {"repobilityId": "c0c62e5993d881b0", "scanner": "scanner-primary", "fingerprint": "bd59f6a539687d47", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "website/plugins/doc-release-data/index.js"}, "region": {"startLine": 15}}}]}, {"ruleId": "scanner-62b07554b7f0cf3d", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in website/scripts/update-blog-releases.js:13"}, "properties": {"repobilityId": "597fe7efeb32c4a4", "scanner": "scanner-primary", "fingerprint": "62b07554b7f0cf3d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "website/scripts/update-blog-releases.js"}, "region": {"startLine": 13}}}]}, {"ruleId": "scanner-f74d573975168e0b", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in website/src/theme/AnnouncementBar/index.tsx:36"}, "properties": {"repobilityId": "6c2d20dcd5e2be64", "scanner": "scanner-primary", "fingerprint": "f74d573975168e0b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "website/src/theme/AnnouncementBar/index.tsx"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-f7bf429f20731f22", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in website/src/components/Screengrab/index.tsx:28"}, "properties": {"repobilityId": "e8a41cc453bc1ac9", "scanner": "scanner-primary", "fingerprint": "f7bf429f20731f22", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "website/src/components/Screengrab/index.tsx"}, "region": {"startLine": 28}}}]}, {"ruleId": "scanner-8efda0df20efbe86", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in website/src/components/Glossary/Glossary.tsx:41"}, "properties": {"repobilityId": "80fdf1b04ae19407", "scanner": "scanner-primary", "fingerprint": "8efda0df20efbe86", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "website/src/components/Glossary/Glossary.tsx"}, "region": {"startLine": 41}}}]}, {"ruleId": "scanner-8f2870cbc2920fc9", "level": "note", "message": {"text": "Insecure pattern 'document_write' in website/src/components/SlideDeck/SlideNotesPopout.tsx:165"}, "properties": {"repobilityId": "1c33b00e8865a259", "scanner": "scanner-primary", "fingerprint": "8f2870cbc2920fc9", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["owasp", "document_write"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "website/src/components/SlideDeck/SlideNotesPopout.tsx"}, "region": {"startLine": 165}}}]}, {"ruleId": "scanner-56eecdbc7f14fe52", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in website/src/components/DefinitionLinkHandler/index.js:25"}, "properties": {"repobilityId": "7eac24df5c88848b", "scanner": "scanner-primary", "fingerprint": "56eecdbc7f14fe52", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "website/src/components/DefinitionLinkHandler/index.js"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-b829554b2ad5c9e1", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in internal/exec/terraform_plan_diff_test.go:437"}, "properties": {"repobilityId": "9f2829e6f28fdf3c", "scanner": "scanner-primary", "fingerprint": "b829554b2ad5c9e1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "internal/exec/terraform_plan_diff_test.go"}, "region": {"startLine": 437}}}]}, {"ruleId": "scanner-6c8f3abf1085e9c3", "level": "warning", "message": {"text": "Insecure pattern 'weak_hash' in internal/terraform_backend/terraform_backend_s3_test.go:5"}, "properties": {"repobilityId": "6661422e702ade21", "scanner": "scanner-primary", "fingerprint": "6c8f3abf1085e9c3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "weak_hash"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "internal/terraform_backend/terraform_backend_s3_test.go"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-6b77583e1f694446", "level": "warning", "message": {"text": "Insecure pattern 'weak_hash' in internal/terraform_backend/terraform_backend_s3.go:5"}, "properties": {"repobilityId": "ec300a3d7da6d934", "scanner": "scanner-primary", "fingerprint": "6b77583e1f694446", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "weak_hash"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "internal/terraform_backend/terraform_backend_s3.go"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-e1f3b6a0477a2e3f", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "c308c7ad9c6ffd4f", "scanner": "scanner-primary", "fingerprint": "e1f3b6a0477a2e3f", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "gists/aws-ami-packer-github-actions/.github/workflows/ami.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dce11a688d4c3b3f", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b6c57c91513dfd38", "scanner": "scanner-primary", "fingerprint": "dce11a688d4c3b3f", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/website-preview-destroy.yml"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-dce11a688d4c3b3f", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4fe6bd83973cd015", "scanner": "scanner-primary", "fingerprint": "dce11a688d4c3b3f", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/website-preview-destroy.yml"}, "region": {"startLine": 52}}}]}, {"ruleId": "scanner-5f059860733a72fa", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "5bce58d3bcff248d", "scanner": "scanner-primary", "fingerprint": "5f059860733a72fa", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/website-preview-destroy.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2c04cdd21c27cfa3", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "77c6e08134f0243e", "scanner": "scanner-primary", "fingerprint": "2c04cdd21c27cfa3", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/website-preview-deploy.yml"}, "region": {"startLine": 49}}}]}, {"ruleId": "scanner-2c04cdd21c27cfa3", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ac5ededa36b3e14d", "scanner": "scanner-primary", "fingerprint": "2c04cdd21c27cfa3", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/website-preview-deploy.yml"}, "region": {"startLine": 62}}}]}, {"ruleId": "scanner-2f8657d4b27213e4", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "cdb2ed8ea5cdb93f", "scanner": "scanner-primary", "fingerprint": "2f8657d4b27213e4", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/website-preview-deploy.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-54b95b9a448d2cac", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "25e1e91604110bb1", "scanner": "scanner-primary", "fingerprint": "54b95b9a448d2cac", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/algolia.yaml"}, "region": {"startLine": 39}}}]}, {"ruleId": "scanner-54b95b9a448d2cac", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e6b62392fa7d1e3f", "scanner": "scanner-primary", "fingerprint": "54b95b9a448d2cac", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/algolia.yaml"}, "region": {"startLine": 44}}}]}, {"ruleId": "scanner-54b95b9a448d2cac", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "25e1e91604110bb1", "scanner": "scanner-primary", "fingerprint": "54b95b9a448d2cac", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/algolia.yaml"}, "region": {"startLine": 81}}}]}, {"ruleId": "scanner-54b95b9a448d2cac", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e6b62392fa7d1e3f", "scanner": "scanner-primary", "fingerprint": "54b95b9a448d2cac", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/algolia.yaml"}, "region": {"startLine": 86}}}]}, {"ruleId": "scanner-61a1a61a5214d62e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6daa7a7ee23d3f1a", "scanner": "scanner-primary", "fingerprint": "61a1a61a5214d62e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pre-commit.yml"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-61a1a61a5214d62e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "27268a7f76ea2ed0", "scanner": "scanner-primary", "fingerprint": "61a1a61a5214d62e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pre-commit.yml"}, "region": {"startLine": 58}}}]}, {"ruleId": "scanner-61a1a61a5214d62e", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a0d51efe79e77d5f", "scanner": "scanner-primary", "fingerprint": "61a1a61a5214d62e", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pre-commit.yml"}, "region": {"startLine": 63}}}]}, {"ruleId": "scanner-9e836d5a564a796c", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1be5e9588a8cc9ef", "scanner": "scanner-primary", "fingerprint": "9e836d5a564a796c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/link-check.yml"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-a68797ee0509e5b5", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ceed8132816bb1d4", "scanner": "scanner-primary", "fingerprint": "a68797ee0509e5b5", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/website-deploy-prod.yml"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-a68797ee0509e5b5", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6d93f79fc9430392", "scanner": "scanner-primary", "fingerprint": "a68797ee0509e5b5", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/website-deploy-prod.yml"}, "region": {"startLine": 48}}}]}, {"ruleId": "scanner-a68797ee0509e5b5", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "081a596bbec12144", "scanner": "scanner-primary", "fingerprint": "a68797ee0509e5b5", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/website-deploy-prod.yml"}, "region": {"startLine": 53}}}]}, {"ruleId": "scanner-685e54a39110c3ba", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "de0b3090c11bd0bb", "scanner": "scanner-primary", "fingerprint": "685e54a39110c3ba", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/website-deploy-prod.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dad199ada0774f37", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "c06c06e7e118f178", "scanner": "scanner-primary", "fingerprint": "dad199ada0774f37", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/atmos-pro.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0912b6b31ae6454f", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "8ecce919d248ebdb", "scanner": "scanner-primary", "fingerprint": "0912b6b31ae6454f", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/feature-release.yml"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-b6bc569271317fe2", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "ff9f74f77822cafc", "scanner": "scanner-primary", "fingerprint": "b6bc569271317fe2", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/feature-release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3823ea44a3f67313", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "66c17f6bf94ae7cb", "scanner": "scanner-primary", "fingerprint": "3823ea44a3f67313", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/screengrabs.yaml"}, "region": {"startLine": 66}}}]}, {"ruleId": "scanner-3823ea44a3f67313", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "94e5ee2f619f9a81", "scanner": "scanner-primary", "fingerprint": "3823ea44a3f67313", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/screengrabs.yaml"}, "region": {"startLine": 95}}}]}, {"ruleId": "scanner-2383fd133281395f", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "2d2194c80360204d", "scanner": "scanner-primary", "fingerprint": "2383fd133281395f", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/screengrabs.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7efbda965f283c17", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8cacc48bd21be7ee", "scanner": "scanner-primary", "fingerprint": "7efbda965f283c17", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test.yml"}, "region": {"startLine": 77}}}]}, {"ruleId": "scanner-7efbda965f283c17", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c7b0656e54a8a817", "scanner": "scanner-primary", "fingerprint": "7efbda965f283c17", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test.yml"}, "region": {"startLine": 98}}}]}, {"ruleId": "scanner-7efbda965f283c17", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "14a46638d9083271", "scanner": "scanner-primary", "fingerprint": "7efbda965f283c17", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test.yml"}, "region": {"startLine": 133}}}]}, {"ruleId": "scanner-7efbda965f283c17", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ff23723f0a96cab6", "scanner": "scanner-primary", "fingerprint": "7efbda965f283c17", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test.yml"}, "region": {"startLine": 156}}}]}, {"ruleId": "scanner-7efbda965f283c17", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f3682ddaf2c92213", "scanner": "scanner-primary", "fingerprint": "7efbda965f283c17", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test.yml"}, "region": {"startLine": 163}}}]}, {"ruleId": "scanner-122306d0275ca17c", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "e44c46d9fbde39ba", "scanner": "scanner-primary", "fingerprint": "122306d0275ca17c", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test.yml"}, "region": {"startLine": 171}}}]}, {"ruleId": "scanner-7efbda965f283c17", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8cacc48bd21be7ee", "scanner": "scanner-primary", "fingerprint": "7efbda965f283c17", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test.yml"}, "region": {"startLine": 205}}}]}, {"ruleId": "scanner-7efbda965f283c17", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d8f8ba9161e1a9f4", "scanner": "scanner-primary", "fingerprint": "7efbda965f283c17", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test.yml"}, "region": {"startLine": 257}}}]}, {"ruleId": "scanner-7efbda965f283c17", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a6e494a1860a62f0", "scanner": "scanner-primary", "fingerprint": "7efbda965f283c17", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test.yml"}, "region": {"startLine": 305}}}]}, {"ruleId": "scanner-7efbda965f283c17", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "14a46638d9083271", "scanner": "scanner-primary", "fingerprint": "7efbda965f283c17", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test.yml"}, "region": {"startLine": 339}}}]}, {"ruleId": "scanner-7efbda965f283c17", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ff23723f0a96cab6", "scanner": "scanner-primary", "fingerprint": "7efbda965f283c17", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test.yml"}, "region": {"startLine": 353}}}]}, {"ruleId": "scanner-7efbda965f283c17", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f3682ddaf2c92213", "scanner": "scanner-primary", "fingerprint": "7efbda965f283c17", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test.yml"}, "region": {"startLine": 359}}}]}, {"ruleId": "scanner-7efbda965f283c17", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "14a46638d9083271", "scanner": "scanner-primary", "fingerprint": "7efbda965f283c17", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test.yml"}, "region": {"startLine": 403}}}]}, {"ruleId": "scanner-7efbda965f283c17", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9c2a5db943b48775", "scanner": "scanner-primary", "fingerprint": "7efbda965f283c17", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test.yml"}, "region": {"startLine": 418}}}]}, {"ruleId": "scanner-7efbda965f283c17", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "14a46638d9083271", "scanner": "scanner-primary", "fingerprint": "7efbda965f283c17", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test.yml"}, "region": {"startLine": 483}}}]}, {"ruleId": "scanner-7efbda965f283c17", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ff23723f0a96cab6", "scanner": "scanner-primary", "fingerprint": "7efbda965f283c17", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test.yml"}, "region": {"startLine": 502}}}]}, {"ruleId": "scanner-7efbda965f283c17", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f3682ddaf2c92213", "scanner": "scanner-primary", "fingerprint": "7efbda965f283c17", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test.yml"}, "region": {"startLine": 509}}}]}, {"ruleId": "scanner-7efbda965f283c17", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ff23723f0a96cab6", "scanner": "scanner-primary", "fingerprint": "7efbda965f283c17", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test.yml"}, "region": {"startLine": 582}}}]}, {"ruleId": "scanner-7efbda965f283c17", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f3682ddaf2c92213", "scanner": "scanner-primary", "fingerprint": "7efbda965f283c17", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test.yml"}, "region": {"startLine": 588}}}]}, {"ruleId": "scanner-7efbda965f283c17", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a9811c19928ce777", "scanner": "scanner-primary", "fingerprint": "7efbda965f283c17", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test.yml"}, "region": {"startLine": 594}}}]}, {"ruleId": "scanner-122306d0275ca17c", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "91650b1760998de8", "scanner": "scanner-primary", "fingerprint": "122306d0275ca17c", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test.yml"}, "region": {"startLine": 644}}}]}, {"ruleId": "scanner-65aa740cba4a4a73", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7640466c92034bac", "scanner": "scanner-primary", "fingerprint": "65aa740cba4a4a73", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/codeql.yml"}, "region": {"startLine": 37}}}]}, {"ruleId": "scanner-65aa740cba4a4a73", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8805470db04747b3", "scanner": "scanner-primary", "fingerprint": "65aa740cba4a4a73", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/codeql.yml"}, "region": {"startLine": 50}}}]}, {"ruleId": "scanner-65aa740cba4a4a73", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3130c0a2c5ea460e", "scanner": "scanner-primary", "fingerprint": "65aa740cba4a4a73", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/codeql.yml"}, "region": {"startLine": 63}}}]}, {"ruleId": "scanner-65aa740cba4a4a73", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3dec6eee6f6c1d0f", "scanner": "scanner-primary", "fingerprint": "65aa740cba4a4a73", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/codeql.yml"}, "region": {"startLine": 97}}}]}, {"ruleId": "scanner-65aa740cba4a4a73", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "87fec4033a6aaaa7", "scanner": "scanner-primary", "fingerprint": "65aa740cba4a4a73", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/codeql.yml"}, "region": {"startLine": 158}}}]}, {"ruleId": "scanner-65aa740cba4a4a73", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "bd82ef418ef17a0d", "scanner": "scanner-primary", "fingerprint": "65aa740cba4a4a73", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/codeql.yml"}, "region": {"startLine": 169}}}]}, {"ruleId": "scanner-a3990e7214f4a9b0", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "84f3835900c99257", "scanner": "scanner-primary", "fingerprint": "a3990e7214f4a9b0", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/nightlybuilds.yml"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-72a894be8f5f2778", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "2a92d8770440dee4", "scanner": "scanner-primary", "fingerprint": "72a894be8f5f2778", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build.yml"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-72a894be8f5f2778", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "d138ce4e8a419092", "scanner": "scanner-primary", "fingerprint": "72a894be8f5f2778", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build.yml"}, "region": {"startLine": 53}}}]}, {"ruleId": "scanner-b769174c9fcf8ea8", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "e34b6cb9b56931d2", "scanner": "scanner-primary", "fingerprint": "b769174c9fcf8ea8", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2305a8d87fbc1767", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "fc8a3a0a6669fa19", "scanner": "scanner-primary", "fingerprint": "2305a8d87fbc1767", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/website-preview-build.yml"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-2305a8d87fbc1767", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "acfc5b8a7551b3b5", "scanner": "scanner-primary", "fingerprint": "2305a8d87fbc1767", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/website-preview-build.yml"}, "region": {"startLine": 39}}}]}, {"ruleId": "scanner-2305a8d87fbc1767", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2c6f5ca8faa8b78b", "scanner": "scanner-primary", "fingerprint": "2305a8d87fbc1767", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/website-preview-build.yml"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-47b88ffa7bfb67e2", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "75dd4a0f7a873eb6", "scanner": "scanner-primary", "fingerprint": "47b88ffa7bfb67e2", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/website-preview-build.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-47d3056e2ebb1aff", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8cf076de48019da5", "scanner": "scanner-primary", "fingerprint": "47d3056e2ebb1aff", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/dependency-review.yml"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-47d3056e2ebb1aff", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5f30924759e6a8b4", "scanner": "scanner-primary", "fingerprint": "47d3056e2ebb1aff", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/dependency-review.yml"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-cf3cc905a18c9d50", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6b8c034859b88d85", "scanner": "scanner-primary", "fingerprint": "cf3cc905a18c9d50", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/setup-go-cache-warmup.yml"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-6f6dcd67c0499fc4", "level": "error", "message": {"text": "tj-actions/changed-files is tag-pinned instead of SHA-pinned"}, "properties": {"repobilityId": "4f777ea1d895e902", "scanner": "scanner-primary", "fingerprint": "6f6dcd67c0499fc4", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/validate-codeowners.yml"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-90d9d3dad32591dc", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "635d77fab42ee421", "scanner": "scanner-primary", "fingerprint": "90d9d3dad32591dc", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/vhs.yaml"}, "region": {"startLine": 79}}}]}, {"ruleId": "scanner-228b5f3176785737", "level": "note", "message": {"text": "Very large file: tests/cli_test.go (1947 lines)"}, "properties": {"repobilityId": "47a80658bd2c9df8", "scanner": "scanner-primary", "fingerprint": "228b5f3176785737", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-a8ef31e7c404fa0d", "level": "note", "message": {"text": "Very large file: tests/cli_locals_test.go (1405 lines)"}, "properties": {"repobilityId": "bcca48ba7aec90c5", "scanner": "scanner-primary", "fingerprint": "a8ef31e7c404fa0d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-c09f6983514bc34c", "level": "note", "message": {"text": "Very large file: pkg/terraform/output/executor_test.go (2413 lines)"}, "properties": {"repobilityId": "fb358bd126a4b5b2", "scanner": "scanner-primary", "fingerprint": "c09f6983514bc34c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ac9358c4353d2821", "level": "note", "message": {"text": "Very large file: pkg/workflow/executor_test.go (1769 lines)"}, "properties": {"repobilityId": "8dadc88e83cdff9d", "scanner": "scanner-primary", "fingerprint": "ac9358c4353d2821", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-2349464b9985b615", "level": "note", "message": {"text": "Very large file: pkg/ci/plugins/terraform/handlers_test.go (1655 lines)"}, "properties": {"repobilityId": "7cbfde543b72e2fc", "scanner": "scanner-primary", "fingerprint": "2349464b9985b615", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e412e7b51ab0d08d", "level": "note", "message": {"text": "Very large file: pkg/utils/yaml_utils_test.go (1680 lines)"}, "properties": {"repobilityId": "33092d360a1e1ee8", "scanner": "scanner-primary", "fingerprint": "e412e7b51ab0d08d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ddc68af9be043c3b", "level": "note", "message": {"text": "Very large file: pkg/auth/manager_test.go (2229 lines)"}, "properties": {"repobilityId": "512dd2a20dee2297", "scanner": "scanner-primary", "fingerprint": "ddc68af9be043c3b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-1e73a18f427f4cc6", "level": "note", "message": {"text": "Very large file: pkg/auth/manager_helpers_test.go (1465 lines)"}, "properties": {"repobilityId": "0b1dc4530b6b4dd1", "scanner": "scanner-primary", "fingerprint": "1e73a18f427f4cc6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-b71a2db54c5beabc", "level": "note", "message": {"text": "Very large file: pkg/auth/identities/aws/user_test.go (2610 lines)"}, "properties": {"repobilityId": "ce1a7f7005f9bd75", "scanner": "scanner-primary", "fingerprint": "b71a2db54c5beabc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-24af3c3f55a0669c", "level": "note", "message": {"text": "Very large file: pkg/auth/identities/aws/webflow_browser_test.go (2148 lines)"}, "properties": {"repobilityId": "19a94e45be230f4d", "scanner": "scanner-primary", "fingerprint": "24af3c3f55a0669c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f0ef6f79ab07b453", "level": "note", "message": {"text": "Very large file: pkg/auth/identities/aws/assume_root_test.go (1914 lines)"}, "properties": {"repobilityId": "f36e6b6d36f4ee0b", "scanner": "scanner-primary", "fingerprint": "f0ef6f79ab07b453", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-c7122f051dc4a04e", "level": "note", "message": {"text": "Very large file: pkg/auth/identities/aws/assume_role_test.go (1759 lines)"}, "properties": {"repobilityId": "122c66c8fbc7b381", "scanner": "scanner-primary", "fingerprint": "c7122f051dc4a04e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e829f994a41e1d1e", "level": "note", "message": {"text": "Very large file: pkg/version/reexec_test.go (1642 lines)"}, "properties": {"repobilityId": "32763edca184f94f", "scanner": "scanner-primary", "fingerprint": "e829f994a41e1d1e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3a5ca14d832f107f", "level": "note", "message": {"text": "Very large file: pkg/dependencies/installer_test.go (1678 lines)"}, "properties": {"repobilityId": "a733e05750e010ce", "scanner": "scanner-primary", "fingerprint": "3a5ca14d832f107f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-a5cbeff4dd99c4ec", "level": "note", "message": {"text": "Very large file: pkg/schema/schema.go (1468 lines)"}, "properties": {"repobilityId": "f5885433daa6a696", "scanner": "scanner-primary", "fingerprint": "a5cbeff4dd99c4ec", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-64d9cb6bf60c31a7", "level": "note", "message": {"text": "Very large file: pkg/toolchain/set_test.go (1819 lines)"}, "properties": {"repobilityId": "121adf4cd16cd12d", "scanner": "scanner-primary", "fingerprint": "64d9cb6bf60c31a7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-83b51f48a360864d", "level": "note", "message": {"text": "Very large file: pkg/toolchain/registry/aqua/aqua_test.go (3090 lines)"}, "properties": {"repobilityId": "ad93de1e0c569564", "scanner": "scanner-primary", "fingerprint": "83b51f48a360864d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-4ab1627f8fb4a36c", "level": "note", "message": {"text": "Very large file: pkg/config/load_test.go (1885 lines)"}, "properties": {"repobilityId": "5c3634d16bbbaaa2", "scanner": "scanner-primary", "fingerprint": "4ab1627f8fb4a36c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-d602fdef45bad8c6", "level": "note", "message": {"text": "Very large file: pkg/config/load.go (1523 lines)"}, "properties": {"repobilityId": "edc8b9d254c7e083", "scanner": "scanner-primary", "fingerprint": "d602fdef45bad8c6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-09f10dd8ba06f56c", "level": "note", "message": {"text": "Very large file: pkg/ai/agent/anthropic/client_test.go (2197 lines)"}, "properties": {"repobilityId": "2bddf499c3a767eb", "scanner": "scanner-primary", "fingerprint": "09f10dd8ba06f56c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-0625f86268a8068b", "level": "note", "message": {"text": "Very large file: pkg/ai/agent/bedrock/client_test.go (2088 lines)"}, "properties": {"repobilityId": "988283d9a8675442", "scanner": "scanner-primary", "fingerprint": "0625f86268a8068b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-b5c010e53301a085", "level": "note", "message": {"text": "Very large file: pkg/ai/tui/chat_test.go (3731 lines)"}, "properties": {"repobilityId": "442a1d8853e60d68", "scanner": "scanner-primary", "fingerprint": "b5c010e53301a085", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-cf8f338c00a24bd2", "level": "note", "message": {"text": "Very large file: pkg/ai/tui/chat_helpers_test.go (3405 lines)"}, "properties": {"repobilityId": "98476b576f766bf8", "scanner": "scanner-primary", "fingerprint": "cf8f338c00a24bd2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6ada5b7da5426323", "level": "note", "message": {"text": "Very large file: pkg/http/client_test.go (1427 lines)"}, "properties": {"repobilityId": "6714ba8b6d8c59d2", "scanner": "scanner-primary", "fingerprint": "6ada5b7da5426323", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-b6f6d1157fc7ac8b", "level": "note", "message": {"text": "Very large file: pkg/scheduler/adapters/terraform_test.go (1770 lines)"}, "properties": {"repobilityId": "7dfcb326231ef51d", "scanner": "scanner-primary", "fingerprint": "b6f6d1157fc7ac8b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-7674ef06c6085bc9", "level": "note", "message": {"text": "Very large file: pkg/ui/formatter_test.go (2343 lines)"}, "properties": {"repobilityId": "9767ef5a7abfa24f", "scanner": "scanner-primary", "fingerprint": "7674ef06c6085bc9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-edae251e4993898f", "level": "note", "message": {"text": "Very large file: internal/exec/workflow_utils_test.go (1696 lines)"}, "properties": {"repobilityId": "6f863d046e401569", "scanner": "scanner-primary", "fingerprint": "edae251e4993898f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-c694466ffe768b4b", "level": "note", "message": {"text": "Very large file: internal/exec/describe_stacks_component_processor_test.go (1516 lines)"}, "properties": {"repobilityId": "cea34454cbac4fc5", "scanner": "scanner-primary", "fingerprint": "c694466ffe768b4b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6792865021e31d70", "level": "note", "message": {"text": "Very large file: internal/exec/terraform_utils_test.go (2621 lines)"}, "properties": {"repobilityId": "69940440ed9565d7", "scanner": "scanner-primary", "fingerprint": "6792865021e31d70", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e244a0f6e1903fb6", "level": "note", "message": {"text": "Very large file: internal/exec/describe_affected_optimizations_test.go (2536 lines)"}, "properties": {"repobilityId": "47b50c3c9ae2dff9", "scanner": "scanner-primary", "fingerprint": "e244a0f6e1903fb6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3c9a485571628907", "level": "note", "message": {"text": "Very large file: internal/exec/stack_processor_utils_test.go (4315 lines)"}, "properties": {"repobilityId": "60b29b2af49c319b", "scanner": "scanner-primary", "fingerprint": "3c9a485571628907", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-5b29a367f2ed69a7", "level": "note", "message": {"text": "Very large file: internal/exec/stack_manifest_name_test.go (1262 lines)"}, "properties": {"repobilityId": "cec34d5dbadeed1c", "scanner": "scanner-primary", "fingerprint": "5b29a367f2ed69a7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-acbc4227dda1a838", "level": "note", "message": {"text": "Very large file: internal/exec/cli_utils_test.go (2192 lines)"}, "properties": {"repobilityId": "7e6fce5a9ee25d80", "scanner": "scanner-primary", "fingerprint": "acbc4227dda1a838", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-8238a4e4f7b94379", "level": "note", "message": {"text": "Very large file: internal/exec/stack_processor_utils.go (2515 lines)"}, "properties": {"repobilityId": "89ef12258a0bb9af", "scanner": "scanner-primary", "fingerprint": "8238a4e4f7b94379", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6a718b3b1060ab4f", "level": "note", "message": {"text": "Very large file: internal/exec/terraform_plan_diff_test.go (1971 lines)"}, "properties": {"repobilityId": "ecca835d5a850497", "scanner": "scanner-primary", "fingerprint": "6a718b3b1060ab4f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ffd3db58edf2e7f6", "level": "note", "message": {"text": "Very large file: internal/exec/describe_affected_utils_test.go (2055 lines)"}, "properties": {"repobilityId": "0866c7e6b12b487a", "scanner": "scanner-primary", "fingerprint": "ffd3db58edf2e7f6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-2a4dc86a95e90779", "level": "note", "message": {"text": "Very large file: internal/exec/describe_affected_test.go (2402 lines)"}, "properties": {"repobilityId": "bc628db809f33822", "scanner": "scanner-primary", "fingerprint": "2a4dc86a95e90779", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f9389f6e50090bba", "level": "note", "message": {"text": "Very large file: errors/errors.go (1193 lines)"}, "properties": {"repobilityId": "cb1eebac7f4af65e", "scanner": "scanner-primary", "fingerprint": "f9389f6e50090bba", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-c48e9b7e9cc3c0ec", "level": "note", "message": {"text": "Very large file: cmd/cmd_utils_test.go (2212 lines)"}, "properties": {"repobilityId": "bf11cd3734755e35", "scanner": "scanner-primary", "fingerprint": "c48e9b7e9cc3c0ec", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-181023d039498b62", "level": "note", "message": {"text": "Very large file: cmd/cmd_utils.go (1683 lines)"}, "properties": {"repobilityId": "2bcb1c73c64dbeca", "scanner": "scanner-primary", "fingerprint": "181023d039498b62", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e8035273a7ca491b", "level": "note", "message": {"text": "Very large file: cmd/root.go (1990 lines)"}, "properties": {"repobilityId": "7cc3ba26f884824a", "scanner": "scanner-primary", "fingerprint": "e8035273a7ca491b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-c200fbdc22b33b78", "level": "note", "message": {"text": "Very large file: cmd/custom_command_flag_conflict_test.go (1508 lines)"}, "properties": {"repobilityId": "2980715e0e049bb7", "scanner": "scanner-primary", "fingerprint": "c200fbdc22b33b78", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-c1a7a4ea8b8e1bbf", "level": "note", "message": {"text": "Very large file: cmd/mcp/server/start_test.go (3461 lines)"}, "properties": {"repobilityId": "5736ae1f8fcb9a47", "scanner": "scanner-primary", "fingerprint": "c1a7a4ea8b8e1bbf", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-bb5eccdd814219e6", "level": "note", "message": {"text": "Very large file: cmd/ai/chat_test.go (2213 lines)"}, "properties": {"repobilityId": "39cd71e8ece805fd", "scanner": "scanner-primary", "fingerprint": "bb5eccdd814219e6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-36687fed1c614763", "level": "note", "message": {"text": "Very large file: cmd/ai/ask_test.go (2309 lines)"}, "properties": {"repobilityId": "40b30fdb1ef0af14", "scanner": "scanner-primary", "fingerprint": "36687fed1c614763", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-5a532f68b29d02ca", "level": "note", "message": {"text": "Very large file: cmd/ai/sessions_test.go (3921 lines)"}, "properties": {"repobilityId": "681e74f694c4c84c", "scanner": "scanner-primary", "fingerprint": "5a532f68b29d02ca", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-a14b4a5b3ab4513f", "level": "note", "message": {"text": "Very large file: cmd/ai/exec_test.go (3407 lines)"}, "properties": {"repobilityId": "fe5e1618e55e9687", "scanner": "scanner-primary", "fingerprint": "a14b4a5b3ab4513f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-d53e6fc6e96b42a4", "level": "note", "message": {"text": "43 TODO/FIXME markers"}, "properties": {"repobilityId": "4b38c118003e07d2", "scanner": "scanner-primary", "fingerprint": "d53e6fc6e96b42a4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["maintenance"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "26d2d3d05e50cce6", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "1c6e40011868c96e", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-9d79c4077342a7d0", "level": "warning", "message": {"text": "Runtime service client appears to use placeholder configuration"}, "properties": {"repobilityId": "39601bc72ad6fbc3", "scanner": "scanner-primary", "fingerprint": "9d79c4077342a7d0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "runtime-config", "service-client", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "0d50b605bfc59bcd", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-bea357a6497a2d5d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: CLAUDE.md"}, "properties": {"repobilityId": "aae72df3934829ac", "scanner": "scanner-primary", "fingerprint": "bea357a6497a2d5d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "CLAUDE.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b58b30d03bc071b4", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: gists/mcp-with-aws/.mcp.json"}, "properties": {"repobilityId": "a68c681732f867cd", "scanner": "scanner-primary", "fingerprint": "b58b30d03bc071b4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "mcp_config"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "gists/mcp-with-aws/.mcp.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2628b6ff2a14bc49", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: agent-skills/skills/atmos-helmfile/SKILL.md"}, "properties": {"repobilityId": "863833e50ff458d5", "scanner": "scanner-primary", "fingerprint": "2628b6ff2a14bc49", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agent-skills/skills/atmos-helmfile/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a931b2b72be7534f", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: agent-skills/skills/atmos-config/SKILL.md"}, "properties": {"repobilityId": "7ff12c96a1e18de7", "scanner": "scanner-primary", "fingerprint": "a931b2b72be7534f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agent-skills/skills/atmos-config/SKILL.md"}, "region": {"startLine": 284}}}]}, {"ruleId": "scanner-06dfa4d96cdb9a80", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: agent-skills/skills/atmos-config/SKILL.md"}, "properties": {"repobilityId": "453a9b88cacc146a", "scanner": "scanner-primary", "fingerprint": "06dfa4d96cdb9a80", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agent-skills/skills/atmos-config/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0f9b9b894fae687b", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: agent-skills/skills/atmos-auth/SKILL.md"}, "properties": {"repobilityId": "9ead1f53f1a3bd52", "scanner": "scanner-primary", "fingerprint": "0f9b9b894fae687b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agent-skills/skills/atmos-auth/SKILL.md"}, "region": {"startLine": 165}}}]}, {"ruleId": "scanner-7c34099155a06e46", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: agent-skills/skills/atmos-auth/SKILL.md"}, "properties": {"repobilityId": "02960bc3222d424c", "scanner": "scanner-primary", "fingerprint": "7c34099155a06e46", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agent-skills/skills/atmos-auth/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7b883defb217076a", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: agent-skills/skills/atmos-gitops/SKILL.md"}, "properties": {"repobilityId": "dd8bdb0ef013aabf", "scanner": "scanner-primary", "fingerprint": "7b883defb217076a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agent-skills/skills/atmos-gitops/SKILL.md"}, "region": {"startLine": 135}}}]}, {"ruleId": "scanner-f2c11a8467e69177", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: agent-skills/skills/atmos-introspection/SKILL.md"}, "properties": {"repobilityId": "f84c437e4a69dc99", "scanner": "scanner-primary", "fingerprint": "f2c11a8467e69177", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agent-skills/skills/atmos-introspection/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ed47439f934998fb", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: agent-skills/skills/atmos-aws-security/SKILL.md"}, "properties": {"repobilityId": "3562a1d8a1309049", "scanner": "scanner-primary", "fingerprint": "ed47439f934998fb", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agent-skills/skills/atmos-aws-security/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c90c5fdcf05cbb98", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: agent-skills/skills/atmos-terraform/SKILL.md"}, "properties": {"repobilityId": "065d0d07b16d59bc", "scanner": "scanner-primary", "fingerprint": "c90c5fdcf05cbb98", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agent-skills/skills/atmos-terraform/SKILL.md"}, "region": {"startLine": 261}}}]}, {"ruleId": "scanner-68421ac74f61351e", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: agent-skills/skills/atmos-terraform/SKILL.md"}, "properties": {"repobilityId": "5704be2815af0403", "scanner": "scanner-primary", "fingerprint": "68421ac74f61351e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agent-skills/skills/atmos-terraform/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-92def1d4807195cc", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: agent-skills/skills/atmos-yaml-functions/SKILL.md"}, "properties": {"repobilityId": "5919633440a6c400", "scanner": "scanner-primary", "fingerprint": "92def1d4807195cc", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agent-skills/skills/atmos-yaml-functions/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8aa73b852023621e", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: agent-skills/skills/atmos-vendoring/SKILL.md"}, "properties": {"repobilityId": "99466523855a9ac6", "scanner": "scanner-primary", "fingerprint": "8aa73b852023621e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agent-skills/skills/atmos-vendoring/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-95236d528c135505", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: agent-skills/skills/atmos-stores/SKILL.md"}, "properties": {"repobilityId": "e8b22501a49a5f11", "scanner": "scanner-primary", "fingerprint": "95236d528c135505", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agent-skills/skills/atmos-stores/SKILL.md"}, "region": {"startLine": 100}}}]}, {"ruleId": "scanner-453195d2681910bc", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: agent-skills/skills/atmos-stores/SKILL.md"}, "properties": {"repobilityId": "bb97d52d1eca42cd", "scanner": "scanner-primary", "fingerprint": "453195d2681910bc", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agent-skills/skills/atmos-stores/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8f6d508c9d48fa9e", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/speckit-git-validate/SKILL.md"}, "properties": {"repobilityId": "9fb229a9a4c411ec", "scanner": "scanner-primary", "fingerprint": "8f6d508c9d48fa9e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/speckit-git-validate/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c3b5bcae91be5465", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/speckit-plan/SKILL.md"}, "properties": {"repobilityId": "2341e0da3d41719a", "scanner": "scanner-primary", "fingerprint": "c3b5bcae91be5465", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/speckit-plan/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-68dfac0dc0956dd3", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/speckit-git-remote/SKILL.md"}, "properties": {"repobilityId": "36186e62c225cbd4", "scanner": "scanner-primary", "fingerprint": "68dfac0dc0956dd3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/speckit-git-remote/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ac8564ae12d191fd", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/speckit-git-commit/SKILL.md"}, "properties": {"repobilityId": "43b42fab5524ece2", "scanner": "scanner-primary", "fingerprint": "ac8564ae12d191fd", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/speckit-git-commit/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-373517c18f0b0dbb", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/speckit-checklist/SKILL.md"}, "properties": {"repobilityId": "1667a8e4fefd656b", "scanner": "scanner-primary", "fingerprint": "373517c18f0b0dbb", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/speckit-checklist/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8492bc3758ab49c6", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/speckit-clarify/SKILL.md"}, "properties": {"repobilityId": "9a9507eca5c0fcc2", "scanner": "scanner-primary", "fingerprint": "8492bc3758ab49c6", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/speckit-clarify/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-78ac78bc4ff3cf46", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/speckit-taskstoissues/SKILL.md"}, "properties": {"repobilityId": "6d7a8ed1d27102fc", "scanner": "scanner-primary", "fingerprint": "78ac78bc4ff3cf46", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/speckit-taskstoissues/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8d996699d6c06141", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/speckit-git-initialize/SKILL.md"}, "properties": {"repobilityId": "cee680aaebe12629", "scanner": "scanner-primary", "fingerprint": "8d996699d6c06141", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/speckit-git-initialize/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3f97467cb715b992", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 .github/actions/verify-sha-pinning/test.mjs:26"}, "properties": {"repobilityId": "d7743f517469d18c", "scanner": "scanner-primary", "fingerprint": "3f97467cb715b992", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-e1de93098d606faa", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 website/plugins/fetch-github-stars/index.js:12"}, "properties": {"repobilityId": "81ad44bfc749a2d2", "scanner": "scanner-primary", "fingerprint": "e1de93098d606faa", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-f7e98eea697a35fd", "level": "none", "message": {"text": "Commented-code block (5 lines) in website/plugins/docusaurus-plugin-llms-txt/src/mdx-normalize.mjs:321"}, "properties": {"repobilityId": "70ddcaf26acb3873", "scanner": "scanner-primary", "fingerprint": "f7e98eea697a35fd", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ed6f86161f5f1857", "level": "none", "message": {"text": "Commented-code block (5 lines) in website/plugins/docusaurus-plugin-llms-txt/src/mdx-normalize.test.mjs:142"}, "properties": {"repobilityId": "05c58e4780d0a139", "scanner": "scanner-primary", "fingerprint": "ed6f86161f5f1857", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9d4a188aca4e0b6e", "level": "none", "message": {"text": "Commented-code block (5 lines) in website/plugins/doc-release-data/index.js:188"}, "properties": {"repobilityId": "d4275228c2273032", "scanner": "scanner-primary", "fingerprint": "9d4a188aca4e0b6e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a514dbafa3ed87aa", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 website/src/components/Glossary/Glossary.tsx:16"}, "properties": {"repobilityId": "43a453c907ac0845", "scanner": "scanner-primary", "fingerprint": "a514dbafa3ed87aa", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-aabdb8e6ceeccc46", "level": "note", "message": {"text": "Legacy-named symbol `widget__copy` in website/src/components/InstallWidget/index.tsx:81"}, "properties": {"repobilityId": "f1e2162107fea059", "scanner": "scanner-primary", "fingerprint": "aabdb8e6ceeccc46", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}]}]}